Overview

overview

7

Static

static

3

Metron-Setup.exe

windows11-ltsc_2024-x64

7

agent.pyc

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    Metron-Setup.exe
  • Size 66.4MB
  • Sample260802-jysafaxhrb
  • SHA256 3f3558ad102c5bbd4964c8898cf3560d1ec4cb25ec3bae2b5b9f11ff54ac30f6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationpyinstallerspywarestealer

Malware Config

Targets

    • Target
      Metron-Setup.exe
    • Size 66.4MB
    • SHA256 3f3558ad102c5bbd4964c8898cf3560d1ec4cb25ec3bae2b5b9f11ff54ac30f6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discoveryexecutionpersistenceprivilege_escalationspywarestealer

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery
    behavioral1
    • Target
      agent.pyc
    • Size 212KB
    • SHA256 db9982dd133646969f1ca3ea36bf3132c208c3a46367cd0653c93d1e28629bd5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

Windows Command Shell

1
T1059.003

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

System Information Discovery

2
T1082

System Network Configuration Discovery

2
T1016

Internet Connection Discovery

1
T1016.001

Wi-Fi Discovery

1
T1016.002

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks